March 2018 - Wine-Bugs - list.winehq.org

[Bug 39500] DRM kernel drivers used by some game demos crash on unimplemented function hal.dll.KeQueryPerformanceCounter (Secret Files: Tunguska, Sherlock Holmes vs Jack the Ripper)

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=39500 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |focht(a)gmx.net Fixed by SHA1| |02a5071674ef2c39f76c7388a10 | |d1cf63a332539 Summary|Multiple game demos crashes |DRM kernel drivers used by |with unimplemented function |some game demos crash on |hal.dll.KeQueryPerformanceC |unimplemented function |ounter (Secret Files: |hal.dll.KeQueryPerformanceC |Tunguska, Sherlock Holmes |ounter (Secret Files: |vs Jack the Ripper) |Tunguska, Sherlock Holmes | |vs Jack the Ripper) Status|STAGED |RESOLVED --- Comment #3 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, this is fixed by commit https://source.winehq.org/git/wine.git/commitdiff/02a5071674ef2c39f76c7388a… Thanks Michael --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Deep Silver/Secret Files Tunguska Demo $ WINEDEBUG=+seh,+relay,+ntoskrnl,+hal wine ./Tunguska.exe >>log.txt 2>&1 ... 0041:Call KERNEL32.CreateFileA(0033f214 "\\\\.\\lirsgt",c0000000,00000000,00000000,00000003,40000000,00000000) ret=004010b9 0041:Ret KERNEL32.CreateFileA() retval=00000040 ret=004010b9 0041:Call KERNEL32.DeviceIoControl(00000040,0022e013,0033f340,00000000,0033f340,00000000,0033f33c,00000000) ret=00401a43 001f:Ret KERNEL32.WaitForMultipleObjectsEx() retval=00000001 ret=7ecd9cec ... 001f:trace:ntoskrnl:dispatch_create device 0x11cca0 -> file 0x11b9e0 001f:trace:ntoskrnl:IoAllocateIrp 1, 0 001f:Call ntdll.RtlAllocateHeap(00110000,00000000,00000094) ret=7ecdc269 001f:Ret ntdll.RtlAllocateHeap() retval=0011d2e0 ret=7ecdc269 001f:trace:ntoskrnl:ExAllocatePoolWithTag 148 pool 0 -> 0x11d2e0 001f:trace:ntoskrnl:IoInitializeIrp 0x11d2e0, 148, 1 001f:Call ntdll.NtGetTickCount() ret=7ecdcb82 001f:Ret ntdll.NtGetTickCount() retval=0051e7c2 ret=7ecdcb82 001f:Call driver dispatch 0x782000 (device=0x11cca0,irp=0x11d2e0) 001f:Call hal.KeQueryPerformanceCounter(00000000) ret=0078200a 001f:trace:ntoskrnl:KeQueryPerformanceCounter ((nil)) 001f:Call ntdll.NtQueryPerformanceCounter(0054fbb0,00000000) ret=f76142c2 001f:Ret ntdll.NtQueryPerformanceCounter() retval=00000000 ret=f76142c2 001f:Ret hal.KeQueryPerformanceCounter() retval=0000000c7f6d191c ret=0078200a 001f:trace:ntoskrnl:__regs_IofCompleteRequest 0x11d2e0 0 001f:trace:ntoskrnl:IoCompleteRequest 0x11d2e0 0 001f:trace:ntoskrnl:IoCompleteRequest calling 0x7ecd8efc( 0x11cca0, 0x11d2e0, 0x48 ) 001f:trace:ntoskrnl:IoCompleteRequest CompletionRoutine returned 0 001f:trace:ntoskrnl:IoFreeIrp 0x11d2e0 001f:trace:ntoskrnl:ExFreePoolWithTag 0x11d2e0 ... --- snip --- Still crashes in the end but these are different problem(s). --- snip --- ... 001f:Call driver dispatch 0x7820c0 (device=0x11cca0,irp=0x11d2e0) 001f:Call ntoskrnl.exe.IoAllocateMdl(0011bac8,00000005,00000000,00000000,00000000) ret=0078165d 001f:trace:ntoskrnl:IoAllocateMdl (0x11bac8, 5, 0, 0, (nil)) 001f:Call ntdll.RtlAllocateHeap(00110000,00000008,00000020) ret=7ecda39c 001f:Ret ntdll.RtlAllocateHeap() retval=0011caf8 ret=7ecda39c 001f:Ret ntoskrnl.exe.IoAllocateMdl() retval=0011caf8 ret=0078165d 001f:Call ntoskrnl.exe.MmProbeAndLockPages(0011caf8,00000001,00000001) ret=00781679 001f:fixme:ntoskrnl:MmProbeAndLockPages (0x11caf8, 1, 1): stub 001f:Ret ntoskrnl.exe.MmProbeAndLockPages() retval=0000003f ret=00781679 001f:Call ntoskrnl.exe.MmMapLockedPagesSpecifyCache(0011caf8,00000000,00000001,00000000,00000000,00000020) ret=0078292c 001f:fixme:ntoskrnl:MmMapLockedPagesSpecifyCache (0x11caf8, 0, 1, (nil), 0, 32): stub 001f:Ret ntoskrnl.exe.MmMapLockedPagesSpecifyCache() retval=00000000 ret=0078292c 001f:Call ntoskrnl.exe.RtlInitUnicodeString(0054fb6c,0054fb74 L"\\Device\\atksgt") ret=00780388 001f:Call ntdll.RtlInitUnicodeString(0054fb6c,0054fb74 L"\\Device\\atksgt") ret=7bc7e247 001f:Ret ntdll.RtlInitUnicodeString() retval=0054fb6c ret=7bc7e247 001f:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0054fb6c ret=00780388 001f:Call ntoskrnl.exe.IoGetDeviceObjectPointer(0054fb6c,00020000,0054fb68,0054fb64) ret=007803a2 001f:fixme:ntoskrnl:IoGetDeviceObjectPointer stub: L"\\Device\\atksgt" 20000 0x54fb68 0x54fb64 001f:Ret ntoskrnl.exe.IoGetDeviceObjectPointer() retval=00000000 ret=007803a2 001f:trace:ntoskrnl:ObDereferenceObject ((nil)): stub 001f:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7803c2 ip=007803c2 tid=001f 001f:trace:seh:raise_exception info[0]=00000001 001f:trace:seh:raise_exception info[1]=00000004 001f:trace:seh:raise_exception eax=00000000 ebx=00000000 ecx=0054fb5c edx=00552f54 esi=0011cd58 edi=0054fe14 001f:trace:seh:raise_exception ebp=00000000 esp=0054fb60 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010212 001f:trace:seh:call_vectored_handlers calling handler at 0x7ecd7f55 code=c0000005 flags=0 001f:trace:seh:call_vectored_handlers handler at 0x7ecd7f55 returned 0 001f:trace:seh:call_stack_handlers calling handler at 0x7bcb01c8 code=c0000005 flags=0 001f:Call KERNEL32.UnhandledExceptionFilter(0054f664) ret=7bcb0203 wine: Unhandled page fault on write access to 0x00000004 at address 0x7803c2 (thread 001f), starting debugger... --- snip --- It's TAGES copy protection system here ('lirsgt', 'atksgt'). $ sha1sum secretfilestunguskademo.exe dud081e71f3c0e6f01ed85185afaf938fe43031df6 secretfilestunguskademo.exe $ du -sh secretfilestunguskademo.exe 575M secretfilestunguskademo.exe $ wine --version wine-3.2-293-g0a72708126 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

March 1, 2018

[Bug 44460] Wine' s loader should prevent multiple executable mappings of images (dlls) backed by the same physical file (long path vs. short path)

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=44460 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |1cee60d06823a6224646b425243 | |ed0617c4d1c0f Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #1 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, this is fixed by commit https://source.winehq.org/git/wine.git/commitdiff/1cee60d06823a6224646b4252… Thanks Alexandre --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/CMS $ WINEDEBUG=+seh,+relay,+module wine ./CMS.exe >>log.txt 2>&1 ... 003f:Call KERNEL32.LoadLibraryA(01375fb0 "C:\\Program Files\\CMS\\WndManager.ocx") ret=00404efc ... 003f:Ret PE DLL (proc=0x15ab467,module=0x1590000 L"WndManager.ocx",reason=PROCESS_ATTACH,res=(nil)) retval=1 003f:trace:module:process_attach (L"WndManager.ocx",(nil)) - END 003f:Ret KERNEL32.LoadLibraryA() retval=01590000 ret=00404efc 003f:Call KERNEL32.GetProcAddress(01590000,0050d090 "DllRegisterServer") ret=00404fa9 003f:Ret KERNEL32.GetProcAddress() retval=015a0010 ret=00404fa9 ... 003f:Call KERNEL32.LoadLibraryExW(0032bc8e L"C:\\Program Files\\CMS\\WndManager.ocx",00000000,0000000b) ret=7e3b701c 003f:trace:module:LdrGetDllHandle L"C:\\Program Files\\CMS\\WndManager.ocx" -> 0x1590000 (load path L"C:\\Program Files\\CMS;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem") 003f:trace:module:LdrAddRefDll (L"WndManager.ocx") ldr.LoadCount: 2 003f:Ret KERNEL32.LoadLibraryExW() retval=01590000 ret=7e3b701c ... 003f:Call KERNEL32.FreeLibrary(01590000) ret=7e3b6f87 003f:trace:module:LdrUnloadDll (0x1590000) 003f:trace:module:LdrUnloadDll (L"WndManager.ocx") - START 003f:trace:module:MODULE_DecRefCount (L"WndManager.ocx") ldr.LoadCount: 1 003f:trace:module:LdrUnloadDll END 003f:Ret KERNEL32.FreeLibrary() retval=00000001 ret=7e3b6f87 ... 003f:Call KERNEL32.GetShortPathNameA(0032bcb4 "C:\\Program Files\\CMS\\WndManager.ocx",00f304a0,00000104) ret=5f411ddd 003f:Ret KERNEL32.GetShortPathNameA() retval=0000001c ret=5f411ddd ... 003f:Call KERNEL32.LoadLibraryExW(00329bee L"C:\\PROG~FBU\\CMS\\WNDM~VNJ.OCX",00000000,00000008) ret=7e598fff 003f:trace:module:load_dll looking for L"C:\\PROG~FBU\\CMS\\WNDM~VNJ.OCX" in L"C:\\PROG~FBU\\CMS;C:\\windows\\system32;C:\\windows\\system;C:\\windows;.;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem" 003f:trace:module:open_dll_file L"\\??\\C:\\PROG~FBU\\CMS\\WNDM~VNJ.OCX" is the same file as existing module 0x1590000 L"C:\\Program Files\\CMS\\WndManager.ocx" 003f:trace:module:load_dll Found L"C:\\Program Files\\CMS\\WndManager.ocx" for L"C:\\PROG~FBU\\CMS\\WNDM~VNJ.OCX" at 0x1590000, count=2 003f:Ret KERNEL32.LoadLibraryExW() retval=01590000 ret=7e598fff ... --- snip --- "same file as existing module" = identity check works. $ wine --version wine-3.2-293-g0a72708126 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

March 1, 2018

[Bug 44636] Sentinel HASP 'hardlock.sys' kernel driver access to CR4 via %ESI register operand not handled in ntoskrnl emulate_instruction

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=44636 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |http://www.mesacg.com/Downl | |oads/MTBen1610su.exe Keywords| |download, hardware, | |obfuscation -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

March 1, 2018

[Bug 44636] New: Sentinel HASP 'hardlock.sys' kernel driver access to CR4 via %ESI register operand not handled in ntoskrnl emulate_instruction

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=44636 Bug ID: 44636 Summary: Sentinel HASP 'hardlock.sys' kernel driver access to CR4 via %ESI register operand not handled in ntoskrnl emulate_instruction Product: Wine Version: 3.2 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 37852 This time it's another variant of bug 30220 now with %ESI being register operand. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Minitab/Minitab 16 $ WINEDEBUG=+seh,+relay,+winedevice,+ntoskrnl wine ./Mtb.exe >>log.txt 2>&1 ... 0019:trace:winedevice:load_driver_module L"C:\\windows\\system32\\drivers\\hardlock.sys": relocating from 0x10000 to 0x780000 ... 0019:Call driver init 0x80ac20 (obj=0x11cb28,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\hardlock") ... 0019:Call ntoskrnl.exe.RtlInitUnicodeString(0065fc74,007efa18 L"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\HaspNt") ret=00786720 0019:Call ntdll.RtlInitUnicodeString(0065fc74,007efa18 L"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\HaspNt") ret=7bc7e247 0019:Ret ntdll.RtlInitUnicodeString() retval=0065fc74 ret=7bc7e247 0019:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0065fc74 ret=00786720 0019:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000001,00000084,36346b48) ret=00786748 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000084) ret=7ecce269 0019:Ret ntdll.RtlAllocateHeap() retval=0011cd08 ret=7ecce269 0019:trace:ntoskrnl:ExAllocatePoolWithTag 132 pool 1 -> 0x11cd08 0019:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=0011cd08 ret=00786748 0019:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000001,00000148,34356b48) ret=007879d7 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000148) ret=7ecce269 0019:Ret ntdll.RtlAllocateHeap() retval=0011d2e8 ret=7ecce269 0019:trace:ntoskrnl:ExAllocatePoolWithTag 328 pool 1 -> 0x11d2e8 0019:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=0011d2e8 ret=007879d7 0019:Call ntoskrnl.exe.RtlInitUnicodeString(0011d2e8,00000000) ret=00787a0f 0019:Call ntdll.RtlInitUnicodeString(0011d2e8,00000000) ret=7bc7e247 0019:Ret ntdll.RtlInitUnicodeString() retval=0011d2e8 ret=7bc7e247 0019:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0011d2e8 ret=00787a0f 0019:trace:seh:raise_exception code=c0000096 flags=0 addr=0x787a18 ip=00787a18 tid=0019 0019:trace:seh:raise_exception eax=00110078 ebx=00000000 ecx=0011d2f0 edx=00000000 esi=0011d2e8 edi=0011cd08 0019:trace:seh:raise_exception ebp=0065fbb4 esp=0065fb64 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 0019:trace:seh:call_vectored_handlers calling handler at 0x7ecc9f55 code=c0000096 flags=0 0019:trace:seh:call_vectored_handlers handler at 0x7ecc9f55 returned 0 0019:trace:seh:call_stack_handlers calling handler at 0x7bcb01c8 code=c0000096 flags=0 0019:Call KERNEL32.UnhandledExceptionFilter(0065f664) ret=7bcb0203 wine: Unhandled privileged instruction at address 0x787a18 (thread 0019), starting debugger... --- snip --- Disassembly: --- snip --- .... 00787A16 FFF6 PUSH ESI 00787A18 0F20E6 MOV ESI,CR4 ; unhandled opcode 00787A1B 66:81E6 F7FF AND SI,0FFF7 00787A20 0F22E6 MOV CR4,ESI ; unhandled opcode 00787A23 5E POP ESI 00787A24 66:05 C800 ADD AX,0C8 00787A28 FFF7 PUSH EDI 00787A2A 66:8946 02 MOV WORD PTR DS:[ESI+2],AX 00787A2E E9 F4F40600 JMP hardlock.007F6F27 ... --- snip --- Source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/instr.c… --- snip --- 329 switch(*instr) 330 { 331 case 0x0f: /* extended instruction */ 332 switch(instr[1]) 333 { 334 case 0x22: /* mov eax, crX */ 335 switch (instr[2]) 336 { 337 case 0xc0: 338 TRACE("mov eax,cr0 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax ); 339 context->Eip += prefixlen+3; 340 return ExceptionContinueExecution; 341 case 0xe0: 342 TRACE("mov eax,cr4 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax ); 343 context->Eip += prefixlen+3; 344 return ExceptionContinueExecution; 345 default: 346 break; /*fallthrough to bad instruction handling */ 347 } 348 ERR("Unsupported EAX -> CR register, eip+2 is %02x\n", instr[2]); 349 break; /*fallthrough to bad instruction handling */ 350 case 0x20: /* mov crX, eax */ 351 switch (instr[2]) 352 { 353 case 0xe0: /* mov cr4, eax */ 354 /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs 355 * bit 0: VME Virtual Mode Exception ? 356 * bit 1: PVI Protected mode Virtual Interrupt 357 * bit 2: TSD Timestamp disable 358 * bit 3: DE Debugging extensions 359 * bit 4: PSE Page size extensions 360 * bit 5: PAE Physical address extension 361 * bit 6: MCE Machine check enable 362 * bit 7: PGE Enable global pages 363 * bit 8: PCE Enable performance counters at IPL3 364 */ 365 TRACE("mov cr4,eax at 0x%08x\n",context->Eip); 366 context->Eax = 0; 367 context->Eip += prefixlen+3; 368 return ExceptionContinueExecution; --- snip --- %EAX as register operand is handled but %ESI not. 0x0f 0x20-0x2f 20: MOV Rd,Cd 21: MOV Rd,Dd 22: MOV Cd,Rd 23: MOV Dd,Rd $ sha1sum MTBen1610su.exe f457d13475a783a0d2fff5566c0279640ba26bc6 MTBen1610su.exe $ du -sh MTBen1610su.exe 93M MTBen1610su.exe $ wine --version wine-3.2-293-g0a72708126 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

March 1, 2018

[Bug 37852] Sentinel HASP 'hardlock.sys' kernel driver custom imports resolver can't cope with many 'ntoskrnl.exe' functions being fowarded to 'ntdll.dll' (Minitab 16 fails to start)

by wine-bugs＠winehq.org

https://bugs.winehq.org/show_bug.cgi?id=37852 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED Fixed by SHA1| |bf35c2612c3c2a166e540fb062b | |96e9f062131e1 --- Comment #4 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, this is fixed by commit https://source.winehq.org/git/wine.git/commitdiff/bf35c2612c3c2a166e540fb06… Thanks Alexandre. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Minitab/Minitab 16 $ WINEDEBUG=+seh,+relay,+winedevice,+ntoskrnl wine ./Mtb.exe >>log.txt 2>&1 ... 0019:Call ntoskrnl.exe.RtlInitUnicodeString(0065fc74,007efa18 L"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\HaspNt") ret=00786720 0019:Call ntdll.RtlInitUnicodeString(0065fc74,007efa18 L"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\HaspNt") ret=7bc7e247 0019:Ret ntdll.RtlInitUnicodeString() retval=0065fc74 ret=7bc7e247 0019:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0065fc74 ret=00786720 0019:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000001,00000084,36346b48) ret=00786748 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000084) ret=7ecce269 0019:Ret ntdll.RtlAllocateHeap() retval=0011cd08 ret=7ecce269 0019:trace:ntoskrnl:ExAllocatePoolWithTag 132 pool 1 -> 0x11cd08 0019:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=0011cd08 ret=00786748 0019:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000001,00000148,34356b48) ret=007879d7 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000148) ret=7ecce269 0019:Ret ntdll.RtlAllocateHeap() retval=0011d2e8 ret=7ecce269 0019:trace:ntoskrnl:ExAllocatePoolWithTag 328 pool 1 -> 0x11d2e8 0019:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=0011d2e8 ret=007879d7 0019:Call ntoskrnl.exe.RtlInitUnicodeString(0011d2e8,00000000) ret=00787a0f 0019:Call ntdll.RtlInitUnicodeString(0011d2e8,00000000) ret=7bc7e247 0019:Ret ntdll.RtlInitUnicodeString() retval=0011d2e8 ret=7bc7e247 0019:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0011d2e8 ret=00787a0f ... --- snip --- The driver still crashes but that's a different problem, actually another variant of bug 30220 (different register operand in opcode). $ wine --version wine-3.2-293-g0a72708126 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

March 1, 2018